Servers and applications
CVE-2026-7168
Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.
- Severity
- Medium 5.3
- Published
- 13 May 2026
- Last changed
- 15 Sept 2026
- Added to UpHeron
- 21 Oct 2026
- Fixed in
- 8.20.0
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
curlServers and applications · cpe:a:haxx:curl |
|